From 41e0a2af24f2dce8f04bb05742651ce5213f749d Mon Sep 17 00:00:00 2001 From: Ben Kalsky Date: Tue, 27 Oct 2026 01:23:49 +0200 Subject: [PATCH] fix(security): the certificate check refuses TLS below 1.2 (CodeQL py/insecure-protocol) Co-Authored-By: Claude Opus 5.5 --- tests/test_security.py | 17 +++++++++++++++++ wordpress-api-pro/scripts/security.py | 1 + 2 files changed, 18 insertions(+) diff --git a/tests/test_security.py b/tests/test_security.py index 9f91be5..49a676c 100644 --- a/tests/test_security.py +++ b/tests/test_security.py @@ -689,6 +689,23 @@ def test_the_audit_no_longer_opens_its_own_socket(self): self.assertNotIn("socket.create_connection", source) self.assertIn("connect_public_tls(", source) + def test_the_certificate_check_refuses_tls_below_1_2(self): + """CodeQL py/insecure-protocol: a bare default context lets Python + builds that still allow TLS 1.0/1.1 negotiate them.""" + import ssl + from unittest import mock as _mock + seen = {} + + def capture(ctx, sock, server_hostname=None): + seen["min"] = ctx.minimum_version + return sock + + fake = _mock.Mock() + with _mock.patch.object(security, "_connect_to_public_host", return_value=fake), \ + _mock.patch.object(ssl.SSLContext, "wrap_socket", autospec=True, side_effect=capture): + security.connect_public_tls("any.example") + self.assertGreaterEqual(seen["min"], ssl.TLSVersion.TLSv1_2) + def test_tls_verification_still_uses_the_hostname(self): """Pinning the address must not weaken certificate checking.""" source = open(os.path.join(SCRIPTS, "security.py"), encoding="utf-8").read() diff --git a/wordpress-api-pro/scripts/security.py b/wordpress-api-pro/scripts/security.py index 6a291e3..2b09506 100644 --- a/wordpress-api-pro/scripts/security.py +++ b/wordpress-api-pro/scripts/security.py @@ -348,6 +348,7 @@ def connect_public_tls(host, port=443, timeout=10): """ context = ssl.create_default_context() + context.minimum_version = ssl.TLSVersion.TLSv1_2 sock = _connect_to_public_host(host, port, timeout) try: return context.wrap_socket(sock, server_hostname=host)